#Requires -Version 5.1
<#
.SYNOPSIS
  SMTPGraphRelay - einfacher SMTP Store-and-Forward Relay zu Microsoft Graph.

.DESCRIPTION
  Nimmt lokale SMTP-Mails an, speichert sie als .eml in einer Queue und sendet sie
  anschließend per Microsoft Graph sendMail mit App-only Zertifikatsauthentifizierung.

  V1.7: SMTP AUTH LOGIN/PLAIN mit PBKDF2-SHA256, Benutzer-/Session-Schutz und V1.6 Queue-/Backpressure-Funktionen
#>

[CmdletBinding()]
param(
    [string]$ConfigPath = "$PSScriptRoot\config.json"
)

$ErrorActionPreference = "Stop"
[Console]::OutputEncoding = [System.Text.Encoding]::UTF8

function Get-LogSettings {
    $maxSizeMB = 10
    $retentionDays = 30
    $cleanupHours = 12

    try {
        if ($script:Config.Logging) {
            if ($script:Config.Logging.PSObject.Properties.Name -contains "MaxFileSizeMB") {
                $v = [int]$script:Config.Logging.MaxFileSizeMB
                if ($v -ge 1 -and $v -le 1024) { $maxSizeMB = $v }
            }

            if ($script:Config.Logging.PSObject.Properties.Name -contains "RetentionDays") {
                $v = [int]$script:Config.Logging.RetentionDays
                if ($v -ge 1 -and $v -le 3650) { $retentionDays = $v }
            }

            if ($script:Config.Logging.PSObject.Properties.Name -contains "CleanupHours") {
                $v = [int]$script:Config.Logging.CleanupHours
                if ($v -ge 1 -and $v -le 168) { $cleanupHours = $v }
            }
        }
    } catch {}

    return [pscustomobject]@{
        MaxFileSizeMB = $maxSizeMB
        RetentionDays = $retentionDays
        CleanupHours = $cleanupHours
    }
}

function Invoke-LogMaintenance {
    param(
        [switch]$Force
    )

    if (-not $script:Config -or -not $script:Config.Paths.Logs) {
        return
    }

    $settings = Get-LogSettings
    $logDir = $script:Config.Paths.Logs

    if (-not [IO.Path]::IsPathRooted($logDir)) {
        if ($PSScriptRoot) {
            $logDir = Join-Path $PSScriptRoot $logDir
        } else {
            return
        }
    }

    New-Item -ItemType Directory -Path $logDir -Force | Out-Null

    if (-not $script:NextLogCleanup) {
        $script:NextLogCleanup = [DateTime]::MinValue
    }

    if (-not $Force -and (Get-Date) -lt $script:NextLogCleanup) {
        return
    }

    $cutoff = (Get-Date).AddDays(-1 * $settings.RetentionDays)

    foreach ($file in Get-ChildItem -LiteralPath $logDir -File -Filter "SMTPGraphRelay-*.log" -ErrorAction SilentlyContinue) {
        if ($file.LastWriteTime -lt $cutoff) {
            try {
                Remove-Item -LiteralPath $file.FullName -Force -ErrorAction Stop
            } catch {}
        }
    }

    $script:NextLogCleanup = (Get-Date).AddHours($settings.CleanupHours)
}

function Rotate-LogIfNeeded {
    param(
        [Parameter(Mandatory)][string]$LogFile
    )

    if (-not (Test-Path -LiteralPath $LogFile)) {
        return
    }

    $settings = Get-LogSettings

    try {
        $file = Get-Item -LiteralPath $LogFile -ErrorAction Stop
        $maxBytes = [int64]$settings.MaxFileSizeMB * 1024 * 1024

        if ($file.Length -lt $maxBytes) {
            return
        }

        $stamp = Get-Date -Format "yyyyMMdd-HHmmss"
        $dir = Split-Path $LogFile -Parent
        $archive = Join-Path $dir "SMTPGraphRelay-$stamp.log"

        $counter = 1
        while (Test-Path -LiteralPath $archive) {
            $archive = Join-Path $dir ("SMTPGraphRelay-{0}-{1}.log" -f $stamp, $counter)
            $counter++
        }

        Move-Item -LiteralPath $LogFile -Destination $archive -Force
    }
    catch {}
}

function Write-Log {
    param(
        [Parameter(Mandatory)][string]$Message,
        [ValidateSet("INFO","WARN","ERROR","DEBUG")][string]$Level = "INFO"
    )

    $ts = Get-Date -Format "yyyy-MM-dd HH:mm:ss.fff"
    $line = "[$ts] [$Level] $Message"
    Write-Host $line

    try {
        if ($script:Config -and $script:Config.Paths.Logs) {
            $logDir = $script:Config.Paths.Logs

            if (-not [IO.Path]::IsPathRooted($logDir)) {
                if ($PSScriptRoot) {
                    $logDir = Join-Path $PSScriptRoot $logDir
                } else {
                    return
                }
            }

            New-Item -ItemType Directory -Path $logDir -Force | Out-Null
            $logFile = Join-Path $logDir "SMTPGraphRelay.log"

            # Mehrere SMTP-Runspaces und der Queue-Worker können gleichzeitig loggen.
            # Ein benannter Mutex schützt Rotation und Schreibzugriff gemeinsam.
            $mutex = New-Object System.Threading.Mutex($false, "Local\SMTPGraphRelay-Log")
            $lockTaken = $false

            try {
                $lockTaken = $mutex.WaitOne(5000)

                if ($lockTaken) {
                    Rotate-LogIfNeeded -LogFile $logFile
                    Add-Content -LiteralPath $logFile -Value $line -Encoding UTF8
                    Invoke-LogMaintenance
                }
            }
            finally {
                if ($lockTaken) {
                    try { $mutex.ReleaseMutex() } catch {}
                }

                $mutex.Dispose()
            }
        }
    }
    catch {}
}

function Resolve-PathFromConfig {
    param([Parameter(Mandatory)][string]$Path)
    if ([IO.Path]::IsPathRooted($Path)) { return $Path }
    return (Join-Path $PSScriptRoot $Path)
}

function Test-IPv4InCidr {
    param(
        [Parameter(Mandatory)][System.Net.IPAddress]$Address,
        [Parameter(Mandatory)][string]$Cidr
    )

    if ($Address.AddressFamily -ne [System.Net.Sockets.AddressFamily]::InterNetwork) {
        return $false
    }

    if ($Cidr -notmatch '^(.+)/(\d{1,2})$') { return $false }

    try {
        $network = [System.Net.IPAddress]::Parse($matches[1])
    } catch {
        return $false
    }

    if ($network.AddressFamily -ne [System.Net.Sockets.AddressFamily]::InterNetwork) {
        return $false
    }

    $prefix = [int]$matches[2]
    if ($prefix -lt 0 -or $prefix -gt 32) { return $false }

    $ipBytes = $Address.GetAddressBytes()
    $netBytes = $network.GetAddressBytes()

    for ($i = 0; $i -lt 4; $i++) {
        $remaining = $prefix - ($i * 8)
        if ($remaining -le 0) { break }

        $bits = [Math]::Min(8, $remaining)
        [byte]$mask = (0xFF -shl (8 - $bits)) -band 0xFF

        if (($ipBytes[$i] -band $mask) -ne ($netBytes[$i] -band $mask)) {
            return $false
        }
    }

    return $true
}

function Test-ClientAllowed {
    param([Parameter(Mandatory)][System.Net.IPAddress]$Address)

    foreach ($entry in @($script:Config.Smtp.AllowedNetworks)) {
        if ($entry -eq "*") { return $true }
        try {
            if ($entry -match '/') {
                if (Test-IPv4InCidr -Address $Address -Cidr $entry) { return $true }
            } elseif ([System.Net.IPAddress]::Parse($entry).Equals($Address)) {
                return $true
            }
        } catch {}
    }
    return $false
}

function Get-GraphConnection {
    if (-not (Get-Module -ListAvailable -Name Microsoft.Graph.Authentication)) {
        throw "Microsoft.Graph.Authentication ist nicht installiert."
    }

    Import-Module Microsoft.Graph.Authentication -ErrorAction Stop

    $cert = Get-Item -LiteralPath ("Cert:\LocalMachine\My\{0}" -f $script:Config.Graph.CertificateThumbprint) -ErrorAction Stop

    $ctx = Get-MgContext
    $needsConnect = $true
    if ($ctx) {
        if ($ctx.ClientId -eq $script:Config.Graph.ClientId -and $ctx.TenantId -eq $script:Config.Graph.TenantId -and $ctx.AuthType -eq "AppOnly") {
            $needsConnect = $false
        }
    }

    if ($needsConnect) {
        Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null
        Connect-MgGraph `
            -TenantId $script:Config.Graph.TenantId `
            -ClientId $script:Config.Graph.ClientId `
            -Certificate $cert `
            -NoWelcome | Out-Null
    }
}

function Set-MimeSender {
    param(
        [Parameter(Mandatory)][byte[]]$MimeBytes,
        [Parameter(Mandatory)][string]$Sender
    )

    # Headerbereich als Latin1 lesen, damit Bytes 1:1 erhalten bleiben.
    $latin1 = [System.Text.Encoding]::GetEncoding(28591)
    $text = $latin1.GetString($MimeBytes)
    $separator = "`r`n`r`n"
    $idx = $text.IndexOf($separator)
    if ($idx -lt 0) {
        $separator = "`n`n"
        $idx = $text.IndexOf($separator)
    }
    if ($idx -lt 0) { return $MimeBytes }

    $headers = $text.Substring(0, $idx)
    $body = $text.Substring($idx + $separator.Length)

    if ($headers -match '(?im)^From:.*(?:\r?\n[ \t].*)*') {
        $headers = [regex]::Replace(
            $headers,
            '(?im)^From:.*(?:\r?\n[ \t].*)*',
            "From: <$Sender>",
            1
        )
    } else {
        $headers = "From: <$Sender>`r`n" + $headers
    }

    return $latin1.GetBytes($headers + "`r`n`r`n" + $body)
}

function Get-QueueDirectories {
    $queueRoot = Resolve-PathFromConfig $script:Config.Paths.Queue
    $failedDir = Resolve-PathFromConfig $script:Config.Paths.Failed

    return [pscustomobject]@{
        Root       = $queueRoot
        Incoming   = Join-Path $queueRoot "incoming"
        Pending    = Join-Path $queueRoot "pending"
        Processing = Join-Path $queueRoot "processing"
        Failed     = $failedDir
    }
}

function Initialize-QueueDirectories {
    $dirs = Get-QueueDirectories

    foreach ($dir in @(
        $dirs.Root,
        $dirs.Incoming,
        $dirs.Pending,
        $dirs.Processing,
        $dirs.Failed
    )) {
        New-Item -ItemType Directory -Path $dir -Force | Out-Null
    }

    # Alte V1-Mails direkt aus queue\ nach pending migrieren.
    foreach ($file in Get-ChildItem -LiteralPath $dirs.Root -Filter "*.eml" -File -ErrorAction SilentlyContinue) {
        $target = Join-Path $dirs.Pending $file.Name
        if (-not (Test-Path -LiteralPath $target)) {
            Move-Item -LiteralPath $file.FullName -Destination $target -Force
        }

        $oldMeta = "$($file.FullName).json"
        if (Test-Path -LiteralPath $oldMeta) {
            $targetMeta = "$target.json"
            if (-not (Test-Path -LiteralPath $targetMeta)) {
                Move-Item -LiteralPath $oldMeta -Destination $targetMeta -Force
            }
        }

        Write-Log "Alte Queue-Mail nach pending migriert: $($file.Name)"
    }

    # Nach Absturz/Neustart können Dateien in processing liegen.
    # Sie werden wieder nach pending gestellt und später erneut versucht.
    foreach ($file in Get-ChildItem -LiteralPath $dirs.Processing -Filter "*.eml" -File -ErrorAction SilentlyContinue) {
        $pendingPath = Join-Path $dirs.Pending $file.Name
        $processingMeta = "$($file.FullName).json"
        $pendingMeta = "$pendingPath.json"

        if (Test-Path -LiteralPath $processingMeta) {
            Move-Item -LiteralPath $processingMeta -Destination $pendingMeta -Force
        }

        Move-Item -LiteralPath $file.FullName -Destination $pendingPath -Force
        Write-Log "Processing-Mail nach Neustart zurück nach pending gestellt: $($file.Name)" "WARN"
    }
}

function Get-GraphFailureInfo {
    param(
        [Parameter(Mandatory)]
        $ErrorRecord
    )

    $statusCode = $null
    $retryAfterSeconds = $null
    $message = $ErrorRecord.Exception.Message

    try {
        $response = $ErrorRecord.Exception.Response

        if ($response) {
            try {
                if ($null -ne $response.StatusCode) {
                    $statusCode = [int]$response.StatusCode
                }
            } catch {}

            try {
                $headers = $response.Headers

                if ($headers) {
                    # HttpResponseMessage / HttpResponseHeaders
                    try {
                        $values = $null
                        if ($headers.TryGetValues("Retry-After", [ref]$values)) {
                            $raw = @($values)[0]
                            if ($raw -match '^\d+$') {
                                $retryAfterSeconds = [int]$raw
                            } else {
                                $retryDate = [DateTimeOffset]::Parse($raw)
                                $seconds = [Math]::Ceiling(($retryDate - [DateTimeOffset]::UtcNow).TotalSeconds)
                                if ($seconds -gt 0) {
                                    $retryAfterSeconds = [int]$seconds
                                }
                            }
                        }
                    } catch {}

                    # WebResponse-artige Header
                    if ($null -eq $retryAfterSeconds) {
                        try {
                            $raw = $headers["Retry-After"]
                            if ($raw) {
                                if ($raw -match '^\d+$') {
                                    $retryAfterSeconds = [int]$raw
                                } else {
                                    $retryDate = [DateTimeOffset]::Parse($raw)
                                    $seconds = [Math]::Ceiling(($retryDate - [DateTimeOffset]::UtcNow).TotalSeconds)
                                    if ($seconds -gt 0) {
                                        $retryAfterSeconds = [int]$seconds
                                    }
                                }
                            }
                        } catch {}
                    }
                }
            } catch {}
        }
    } catch {}

    # Fallback: Statuscode aus Text extrahieren, falls das Graph-Modul ihn nur dort liefert.
    if ($null -eq $statusCode) {
        $combined = "$message $($ErrorRecord | Out-String)"
        if ($combined -match '(?<!\d)(400|401|403|404|408|409|410|412|413|415|422|423|429|500|501|502|503|504)(?!\d)') {
            $statusCode = [int]$matches[1]
        }
    }

    return [pscustomobject]@{
        StatusCode        = $statusCode
        RetryAfterSeconds = $retryAfterSeconds
        Message           = $message
    }
}

function Get-RetryDecision {
    param(
        [Parameter(Mandatory)]
        $FailureInfo,

        [Parameter(Mandatory)]
        [int]$RetryCount
    )

    $statusCode = $FailureInfo.StatusCode

    # Graph Throttling: Retry-After bevorzugen.
    if ($statusCode -eq 429) {
        if ($FailureInfo.RetryAfterSeconds -and $FailureInfo.RetryAfterSeconds -gt 0) {
            return [pscustomobject]@{
                Retry = $true
                DelaySeconds = [int]$FailureInfo.RetryAfterSeconds
                Reason = "Graph 429 / Retry-After"
            }
        }

        # Falls kein Retry-After vorhanden ist: exponentielles Backoff.
        $seconds = [Math]::Min(3600, [Math]::Pow(2, [Math]::Min($RetryCount, 10)) * 5)
        return [pscustomobject]@{
            Retry = $true
            DelaySeconds = [int]$seconds
            Reason = "Graph 429 / exponentielles Backoff"
        }
    }

    # Serverfehler und Request Timeout sind typischerweise temporär.
    if ($statusCode -eq 408 -or ($statusCode -ge 500 -and $statusCode -le 599)) {
        $delays = @($script:Config.Queue.RetryMinutes)
        $index = [Math]::Min([Math]::Max($RetryCount - 1, 0), $delays.Count - 1)
        return [pscustomobject]@{
            Retry = $true
            DelaySeconds = ([int]$delays[$index] * 60)
            Reason = "temporärer HTTP-Fehler $statusCode"
        }
    }

    # Typische Auth-/RBAC-/Requestfehler sind ohne Konfigurationsänderung permanent.
    if ($statusCode -in @(400,401,403,404,409,410,412,413,415,422,423)) {
        return [pscustomobject]@{
            Retry = $false
            DelaySeconds = 0
            Reason = "permanenter HTTP-Fehler $statusCode"
        }
    }

    # Kein Statuscode: meist DNS/TLS/Socket/Timeout. Mit normalem Retry behandeln.
    if ($null -eq $statusCode) {
        $delays = @($script:Config.Queue.RetryMinutes)
        $index = [Math]::Min([Math]::Max($RetryCount - 1, 0), $delays.Count - 1)
        return [pscustomobject]@{
            Retry = $true
            DelaySeconds = ([int]$delays[$index] * 60)
            Reason = "Netzwerk-/Transportfehler"
        }
    }

    # Unbekannte 4xx lieber nicht endlos wiederholen.
    if ($statusCode -ge 400 -and $statusCode -le 499) {
        return [pscustomobject]@{
            Retry = $false
            DelaySeconds = 0
            Reason = "unbekannter Clientfehler $statusCode"
        }
    }

    # Defensive Default-Policy.
    $delays = @($script:Config.Queue.RetryMinutes)
    $index = [Math]::Min([Math]::Max($RetryCount - 1, 0), $delays.Count - 1)
    return [pscustomobject]@{
        Retry = $true
        DelaySeconds = ([int]$delays[$index] * 60)
        Reason = "unbekannter temporärer Fehler"
    }
}

function Move-QueueItem {
    param(
        [Parameter(Mandatory)][string]$SourceEml,
        [Parameter(Mandatory)][string]$DestinationDirectory
    )

    New-Item -ItemType Directory -Path $DestinationDirectory -Force | Out-Null

    $sourceMeta = "$SourceEml.json"
    $destinationEml = Join-Path $DestinationDirectory (Split-Path $SourceEml -Leaf)
    $destinationMeta = "$destinationEml.json"

    # Metadaten zuerst bewegen, .eml zuletzt. Dadurch sieht der Worker niemals
    # eine neue .eml-Datei ohne bereits vorhandene Metadaten.
    if (Test-Path -LiteralPath $sourceMeta) {
        Move-Item -LiteralPath $sourceMeta -Destination $destinationMeta -Force
    }

    Move-Item -LiteralPath $SourceEml -Destination $destinationEml -Force

    return $destinationEml
}

function Send-QueuedMail {
    param([Parameter(Mandatory)][string]$FilePath)

    $dirs = Get-QueueDirectories
    $metaPath = "$FilePath.json"
    $meta = $null
    $queueId = [IO.Path]::GetFileNameWithoutExtension($FilePath)

    if (Test-Path -LiteralPath $metaPath) {
        try {
            $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json
        } catch {
            Write-Log "Queue-Metadaten unlesbar für $(Split-Path $FilePath -Leaf): $($_.Exception.Message)" "WARN"
        }
    }

    if (-not $meta) {
        $meta = [pscustomobject]@{
            QueueId = $queueId
            ReceivedUtc = [DateTime]::UtcNow.ToString("o")
            RetryCount = 0
            NextAttemptUtc = [DateTime]::UtcNow.ToString("o")
        }
    }

    if ($meta -and $meta.PSObject.Properties.Name -contains "QueueId" -and -not [string]::IsNullOrWhiteSpace([string]$meta.QueueId)) {
        $queueId = [string]$meta.QueueId
    }

    $bytes = [IO.File]::ReadAllBytes($FilePath)

    if ($script:Config.Graph.ForceSender) {
        $bytes = Set-MimeSender -MimeBytes $bytes -Sender $script:Config.Graph.SenderMailbox
    }

    try {
        Get-GraphConnection

        $sender = [Uri]::EscapeDataString($script:Config.Graph.SenderMailbox)
        $uri = "https://graph.microsoft.com/v1.0/users/$sender/sendMail"
        $base64 = [Convert]::ToBase64String($bytes)

        Invoke-MgGraphRequest `
            -Method POST `
            -Uri $uri `
            -Body $base64 `
            -ContentType "text/plain" `
            -OutputType PSObject | Out-Null

        # Graph sendMail liefert bei Annahme 202 Accepted.
        # Invoke-MgGraphRequest wirft bei Fehlern eine Exception; kein Fehler bedeutet hier angenommen.
        Write-Log ("[{0}] Mail von Graph angenommen (202 Accepted)." -f $queueId)

        Remove-Item -LiteralPath $FilePath -Force
        if (Test-Path -LiteralPath $metaPath) {
            Remove-Item -LiteralPath $metaPath -Force
        }

        return $true
    }
    catch {
        $retryCount = 0
        if ($null -ne $meta.RetryCount) {
            $retryCount = [int]$meta.RetryCount
        }
        $retryCount++

        $failure = Get-GraphFailureInfo -ErrorRecord $_
        $decision = Get-RetryDecision -FailureInfo $failure -RetryCount $retryCount
        $maxRetries = [int]$script:Config.Queue.MaxRetries

        $statusText = if ($null -ne $failure.StatusCode) {
            "HTTP $($failure.StatusCode)"
        } else {
            "ohne HTTP-Status"
        }

        if (-not $decision.Retry) {
            Write-Log ("[{0}] Graph-Versand permanent fehlgeschlagen ({1}, {2}): {3}" -f $queueId, $statusText, $decision.Reason, $failure.Message) "ERROR"

            $newMeta = [ordered]@{
                QueueId = $queueId
                ReceivedUtc = $meta.ReceivedUtc
                RemoteAddress = $meta.RemoteAddress
                EnvelopeFrom = $meta.EnvelopeFrom
                EnvelopeRecipients = @($meta.EnvelopeRecipients)
                RetryCount = $retryCount
                FailedUtc = [DateTime]::UtcNow.ToString("o")
                LastStatusCode = $failure.StatusCode
                LastError = $failure.Message
                FailureReason = $decision.Reason
            }
            $newMeta | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $metaPath -Encoding UTF8

            [void](Move-QueueItem -SourceEml $FilePath -DestinationDirectory $dirs.Failed)
            return $false
        }

        if ($retryCount -ge $maxRetries) {
            Write-Log ("[{0}] Graph-Versand nach {1} Versuchen endgültig fehlgeschlagen ({2}): {3}" -f $queueId, $retryCount, $statusText, $failure.Message) "ERROR"

            $newMeta = [ordered]@{
                QueueId = $queueId
                ReceivedUtc = $meta.ReceivedUtc
                RemoteAddress = $meta.RemoteAddress
                EnvelopeFrom = $meta.EnvelopeFrom
                EnvelopeRecipients = @($meta.EnvelopeRecipients)
                RetryCount = $retryCount
                FailedUtc = [DateTime]::UtcNow.ToString("o")
                LastStatusCode = $failure.StatusCode
                LastError = $failure.Message
                FailureReason = "MaxRetries erreicht"
            }
            $newMeta | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $metaPath -Encoding UTF8

            [void](Move-QueueItem -SourceEml $FilePath -DestinationDirectory $dirs.Failed)
            return $false
        }

        $next = (Get-Date).AddSeconds([int]$decision.DelaySeconds)
        $newMeta = [ordered]@{
            QueueId = $queueId
            ReceivedUtc = $meta.ReceivedUtc
            RemoteAddress = $meta.RemoteAddress
            EnvelopeFrom = $meta.EnvelopeFrom
            EnvelopeRecipients = @($meta.EnvelopeRecipients)
            RetryCount = $retryCount
            NextAttemptUtc = $next.ToUniversalTime().ToString("o")
            LastAttemptUtc = [DateTime]::UtcNow.ToString("o")
            LastStatusCode = $failure.StatusCode
            LastError = $failure.Message
            RetryReason = $decision.Reason
        }
        $newMeta | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $metaPath -Encoding UTF8

        $delayText = if ($decision.DelaySeconds -ge 60) {
            "{0:N1} Min." -f ($decision.DelaySeconds / 60)
        } else {
            "$($decision.DelaySeconds) Sek."
        }

        Write-Log ("[{0}] Graph-Versand fehlgeschlagen (Versuch {1}/{2}, {3}, {4}). Neuer Versuch in {5}: {6}" -f `
            $queueId, $retryCount, $maxRetries, $statusText, $decision.Reason, $delayText, $failure.Message) "WARN"

        [void](Move-QueueItem -SourceEml $FilePath -DestinationDirectory $dirs.Pending)
        return $false
    }
}

function Process-Queue {
    $dirs = Get-QueueDirectories

    foreach ($file in Get-ChildItem -LiteralPath $dirs.Pending -Filter "*.eml" -File | Sort-Object CreationTimeUtc) {
        $metaPath = "$($file.FullName).json"

        if (Test-Path -LiteralPath $metaPath) {
            try {
                $meta = Get-Content -LiteralPath $metaPath -Raw -Encoding UTF8 | ConvertFrom-Json

                if ($meta.NextAttemptUtc) {
                    $next = [DateTime]::Parse($meta.NextAttemptUtc).ToUniversalTime()
                    if ($next -gt [DateTime]::UtcNow) {
                        continue
                    }
                }
            }
            catch {
                Write-Log "Queue-Metadaten konnten nicht gelesen werden: $metaPath" "WARN"
            }
        }

        try {
            $processingPath = Move-QueueItem `
                -SourceEml $file.FullName `
                -DestinationDirectory $dirs.Processing

            [void](Send-QueuedMail -FilePath $processingPath)
        }
        catch {
            Write-Log "Queue-Verarbeitung für $($file.Name) fehlgeschlagen: $($_.Exception.Message)" "ERROR"

            # Falls das Verschieben nach processing bereits geklappt hat, zurück nach pending.
            $possibleProcessing = Join-Path $dirs.Processing $file.Name
            if (Test-Path -LiteralPath $possibleProcessing) {
                try {
                    [void](Move-QueueItem -SourceEml $possibleProcessing -DestinationDirectory $dirs.Pending)
                } catch {
                    Write-Log "Queue-Recovery fehlgeschlagen für $($file.Name): $($_.Exception.Message)" "ERROR"
                }
            }
        }
    }
}


function New-QueueId {
    # Kurz genug für Logs/SMTP-Antworten, aber mit sehr hoher Kollisionsreserve.
    return ([guid]::NewGuid().ToString("N").Substring(0,12).ToUpperInvariant())
}

function Add-RelayMessageHeaders {
    param(
        [Parameter(Mandatory)]
        [AllowEmptyCollection()]
        [AllowEmptyString()]
        [System.Collections.Generic.List[string]]$Lines,

        [Parameter(Mandatory)]
        [string]$QueueId,

        [Parameter(Mandatory)]
        [string]$RemoteAddress
    )

    $result = New-Object System.Collections.Generic.List[string]

    # Header/Body-Grenze suchen. Falls eine kaputte Minimalnachricht keine Leerzeile
    # besitzt, behandeln wir den kompletten Inhalt als Headerblock und ergänzen die
    # notwendige Trennzeile.
    $separatorIndex = -1
    for ($i = 0; $i -lt $Lines.Count; $i++) {
        if ($Lines[$i] -eq "") {
            $separatorIndex = $i
            break
        }
    }

    $headerEnd = if ($separatorIndex -ge 0) { $separatorIndex } else { $Lines.Count }

    $hasMessageId = $false
    for ($i = 0; $i -lt $headerEnd; $i++) {
        if ($Lines[$i] -match '^(?i)Message-ID\s*:') {
            $hasMessageId = $true
            break
        }
    }

    $hostname = [string]$script:Config.Smtp.Hostname
    if ([string]::IsNullOrWhiteSpace($hostname)) {
        $hostname = $env:COMPUTERNAME
    }

    $date = [DateTimeOffset]::Now.ToString("ddd, dd MMM yyyy HH:mm:ss zzz", [Globalization.CultureInfo]::InvariantCulture)
    $received = "Received: from [$RemoteAddress] by $hostname with SMTPGraphRelay; $date"

    # Received immer ganz oben vor die ursprünglichen Header setzen.
    $result.Add($received)

    if (-not $hasMessageId) {
        $safeHost = ($hostname -replace '[^A-Za-z0-9._-]', '-')
        $messageId = "<$QueueId.$([DateTime]::UtcNow.ToString('yyyyMMddHHmmss'))@$safeHost>"
        $result.Add("Message-ID: $messageId")
    }

    for ($i = 0; $i -lt $Lines.Count; $i++) {
        $result.Add($Lines[$i])
    }

    if ($separatorIndex -lt 0) {
        $result.Add("")
    }

    return $result
}


function Test-AddressInList {
    param(
        [Parameter(Mandatory)][System.Net.IPAddress]$Address,
        [object[]]$Entries
    )

    foreach ($entry in @($Entries)) {
        if ($null -eq $entry) { continue }

        $value = [string]$entry
        if ([string]::IsNullOrWhiteSpace($value)) { continue }

        if ($value -eq "*") { return $true }

        try {
            if ($value -match '/') {
                if (Test-IPv4InCidr -Address $Address -Cidr $value) {
                    return $true
                }
            }
            elseif ([System.Net.IPAddress]::Parse($value).Equals($Address)) {
                return $true
            }
        }
        catch {}
    }

    return $false
}

function Get-SmtpAuthSettings {
    $requireAuth = $false
    $maxFailures = 5
    $allowUnauthenticatedNetworks = @()
    $users = @()

    try {
        if ($script:Config.Smtp.PSObject.Properties.Name -contains "RequireAuth") {
            $requireAuth = [bool]$script:Config.Smtp.RequireAuth
        }

        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AuthMaxFailures") {
            $v = [int]$script:Config.Smtp.AuthMaxFailures
            if ($v -ge 1 -and $v -le 100) {
                $maxFailures = $v
            }
        }

        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AllowUnauthenticatedNetworks") {
            $allowUnauthenticatedNetworks = @($script:Config.Smtp.AllowUnauthenticatedNetworks)
        }

        if ($script:Config.Smtp.PSObject.Properties.Name -contains "AuthUsers") {
            $users = @($script:Config.Smtp.AuthUsers)
        }
    }
    catch {}

    return [pscustomobject]@{
        RequireAuth = $requireAuth
        AuthMaxFailures = $maxFailures
        AllowUnauthenticatedNetworks = $allowUnauthenticatedNetworks
        Users = $users
    }
}

function Test-SmtpAuthenticationRequired {
    param([Parameter(Mandatory)][System.Net.IPAddress]$Address)

    $settings = Get-SmtpAuthSettings

    if (-not $settings.RequireAuth) {
        return $false
    }

    if (Test-AddressInList -Address $Address -Entries $settings.AllowUnauthenticatedNetworks) {
        return $false
    }

    return $true
}

function ConvertFrom-Base64Utf8 {
    param([Parameter(Mandatory)][string]$Value)

    try {
        $bytes = [Convert]::FromBase64String($Value)
        return [Text.Encoding]::UTF8.GetString($bytes)
    }
    catch {
        throw "Invalid Base64 data"
    }
}

function Invoke-Pbkdf2Sha256 {
    param(
        [Parameter(Mandatory)][string]$Password,
        [Parameter(Mandatory)][byte[]]$Salt,
        [Parameter(Mandatory)][int]$Iterations,
        [int]$Length = 32
    )

    if ($Iterations -lt 1) {
        throw "Iterations must be greater than zero."
    }

    # Auf unterstützten .NET-Framework-Versionen verwenden wir die native,
    # schnelle PBKDF2-SHA256-Implementierung.
    try {
        $derive = New-Object System.Security.Cryptography.Rfc2898DeriveBytes(
            $Password,
            $Salt,
            $Iterations,
            [System.Security.Cryptography.HashAlgorithmName]::SHA256
        )

        try {
            return $derive.GetBytes($Length)
        }
        finally {
            $derive.Dispose()
        }
    }
    catch {
        # Kompatibilitäts-Fallback für ältere .NET-Framework-Stände.
        $hmac = New-Object System.Security.Cryptography.HMACSHA256
        $hmac.Key = [Text.Encoding]::UTF8.GetBytes($Password)

        try {
            $hashLength = 32
            $blocks = [Math]::Ceiling($Length / [double]$hashLength)
            $output = New-Object byte[] ($blocks * $hashLength)
            $offset = 0

            for ($block = 1; $block -le $blocks; $block++) {
                $blockBytes = [BitConverter]::GetBytes([int]$block)
                if ([BitConverter]::IsLittleEndian) {
                    [Array]::Reverse($blockBytes)
                }

                $input = New-Object byte[] ($Salt.Length + 4)
                [Array]::Copy($Salt, 0, $input, 0, $Salt.Length)
                [Array]::Copy($blockBytes, 0, $input, $Salt.Length, 4)

                $u = $hmac.ComputeHash($input)
                $t = New-Object byte[] $u.Length
                [Array]::Copy($u, $t, $u.Length)

                for ($i = 2; $i -le $Iterations; $i++) {
                    $u = $hmac.ComputeHash($u)
                    for ($j = 0; $j -lt $t.Length; $j++) {
                        $t[$j] = $t[$j] -bxor $u[$j]
                    }
                }

                [Array]::Copy($t, 0, $output, $offset, $t.Length)
                $offset += $t.Length
            }

            $result = New-Object byte[] $Length
            [Array]::Copy($output, 0, $result, 0, $Length)
            return $result
        }
        finally {
            $hmac.Dispose()
        }
    }
}

function Test-FixedTimeEquals {
    param(
        [Parameter(Mandatory)][byte[]]$A,
        [Parameter(Mandatory)][byte[]]$B
    )

    if ($A.Length -ne $B.Length) {
        return $false
    }

    [int]$difference = 0
    for ($i = 0; $i -lt $A.Length; $i++) {
        $difference = $difference -bor ($A[$i] -bxor $B[$i])
    }

    return ($difference -eq 0)
}

function Test-SmtpCredentials {
    param(
        [Parameter(Mandatory)][string]$Username,
        [Parameter(Mandatory)][string]$Password
    )

    if ([string]::IsNullOrWhiteSpace($Username)) {
        return $false
    }

    $settings = Get-SmtpAuthSettings
    $user = $settings.Users |
        Where-Object { ([string]$_.Username).Equals($Username, [StringComparison]::OrdinalIgnoreCase) } |
        Select-Object -First 1

    if (-not $user) {
        # Bewusst keine Unterscheidung im SMTP-Result zwischen unbekanntem
        # Benutzer und falschem Passwort.
        return $false
    }

    try {
        $salt = [Convert]::FromBase64String([string]$user.Salt)
        $expected = [Convert]::FromBase64String([string]$user.PasswordHash)
        $iterations = [int]$user.Iterations

        if ($iterations -lt 10000 -or $expected.Length -lt 16 -or $salt.Length -lt 8) {
            return $false
        }

        $actual = Invoke-Pbkdf2Sha256 `
            -Password $Password `
            -Salt $salt `
            -Iterations $iterations `
            -Length $expected.Length

        return (Test-FixedTimeEquals -A $actual -B $expected)
    }
    catch {
        return $false
    }
}

function Invoke-SmtpAuthLogin {
    param(
        [Parameter(Mandatory)][System.IO.StreamReader]$Reader,
        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
        [string]$InitialResponse
    )

    try {
        if ([string]::IsNullOrWhiteSpace($InitialResponse)) {
            Write-SmtpLine $Writer "334 VXNlcm5hbWU6"
            $encodedUser = $Reader.ReadLine()
            if ($null -eq $encodedUser) { throw "Client disconnected during AUTH LOGIN" }
        }
        else {
            $encodedUser = $InitialResponse
        }

        $username = ConvertFrom-Base64Utf8 -Value $encodedUser

        Write-SmtpLine $Writer "334 UGFzc3dvcmQ6"
        $encodedPassword = $Reader.ReadLine()
        if ($null -eq $encodedPassword) { throw "Client disconnected during AUTH LOGIN" }

        $password = ConvertFrom-Base64Utf8 -Value $encodedPassword

        return [pscustomobject]@{
            Valid = (Test-SmtpCredentials -Username $username -Password $password)
            Username = $username
            ProtocolError = $false
        }
    }
    catch {
        return [pscustomobject]@{
            Valid = $false
            Username = $null
            ProtocolError = $true
        }
    }
}

function Invoke-SmtpAuthPlain {
    param(
        [Parameter(Mandatory)][System.IO.StreamReader]$Reader,
        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
        [string]$InitialResponse
    )

    try {
        $encoded = $InitialResponse

        if ([string]::IsNullOrWhiteSpace($encoded)) {
            Write-SmtpLine $Writer "334"
            $encoded = $Reader.ReadLine()
            if ($null -eq $encoded) { throw "Client disconnected during AUTH PLAIN" }
        }

        $decoded = ConvertFrom-Base64Utf8 -Value $encoded
        $parts = $decoded -split "`0", 3

        if ($parts.Count -lt 3) {
            throw "Invalid AUTH PLAIN payload"
        }

        # RFC 4616: [authzid] NUL authcid NUL passwd
        $username = $parts[1]
        $password = $parts[2]

        return [pscustomobject]@{
            Valid = (Test-SmtpCredentials -Username $username -Password $password)
            Username = $username
            ProtocolError = $false
        }
    }
    catch {
        return [pscustomobject]@{
            Valid = $false
            Username = $null
            ProtocolError = $true
        }
    }
}

function Get-SmtpLimits {
    $maxRecipients = 50
    $maxMessagesPerConnection = 25
    $maxPendingMessages = 5000
    $minFreeDiskSpaceMB = 1024

    try {
        if ($script:Config.Smtp.PSObject.Properties.Name -contains "MaxRecipients") {
            $v = [int]$script:Config.Smtp.MaxRecipients
            if ($v -ge 1 -and $v -le 1000) { $maxRecipients = $v }
        }

        if ($script:Config.Smtp.PSObject.Properties.Name -contains "MaxMessagesPerConnection") {
            $v = [int]$script:Config.Smtp.MaxMessagesPerConnection
            if ($v -ge 1 -and $v -le 10000) { $maxMessagesPerConnection = $v }
        }

        if ($script:Config.Queue.PSObject.Properties.Name -contains "MaxPendingMessages") {
            $v = [int]$script:Config.Queue.MaxPendingMessages
            if ($v -ge 1 -and $v -le 1000000) { $maxPendingMessages = $v }
        }

        if ($script:Config.Queue.PSObject.Properties.Name -contains "MinFreeDiskSpaceMB") {
            $v = [int]$script:Config.Queue.MinFreeDiskSpaceMB
            if ($v -ge 0 -and $v -le 1048576) { $minFreeDiskSpaceMB = $v }
        }
    }
    catch {}

    return [pscustomobject]@{
        MaxRecipients = $maxRecipients
        MaxMessagesPerConnection = $maxMessagesPerConnection
        MaxPendingMessages = $maxPendingMessages
        MinFreeDiskSpaceMB = $minFreeDiskSpaceMB
    }
}

function Get-QueuePressure {
    $dirs = Get-QueueDirectories
    $limits = Get-SmtpLimits

    try {
        $pendingCount = @(
            Get-ChildItem -LiteralPath $dirs.Pending -Filter "*.eml" -File -ErrorAction Stop
        ).Count
    }
    catch {
        return [pscustomobject]@{
            Accept = $false
            SmtpCode = "451 4.3.0 SMTPGraphRelay queue temporarily unavailable"
            Reason = "Pending-Queue konnte nicht gelesen werden: $($_.Exception.Message)"
            PendingCount = $null
            FreeSpaceMB = $null
        }
    }

    if ($pendingCount -ge $limits.MaxPendingMessages) {
        return [pscustomobject]@{
            Accept = $false
            SmtpCode = "452 4.3.1 SMTPGraphRelay queue limit reached"
            Reason = "Pending-Queue-Limit erreicht ($pendingCount/$($limits.MaxPendingMessages))"
            PendingCount = $pendingCount
            FreeSpaceMB = $null
        }
    }

    $freeSpaceMB = $null

    try {
        $fullQueuePath = [IO.Path]::GetFullPath($dirs.Root)
        $root = [IO.Path]::GetPathRoot($fullQueuePath)

        if ($root) {
            $driveInfo = New-Object System.IO.DriveInfo($root)
            if ($driveInfo.IsReady) {
                $freeSpaceMB = [Math]::Floor($driveInfo.AvailableFreeSpace / 1MB)
            }
        }
    }
    catch {
        return [pscustomobject]@{
            Accept = $false
            SmtpCode = "451 4.3.0 SMTPGraphRelay storage status unavailable"
            Reason = "Freier Speicher konnte nicht ermittelt werden: $($_.Exception.Message)"
            PendingCount = $pendingCount
            FreeSpaceMB = $null
        }
    }

    if ($null -ne $freeSpaceMB -and $freeSpaceMB -lt $limits.MinFreeDiskSpaceMB) {
        return [pscustomobject]@{
            Accept = $false
            SmtpCode = "452 4.3.1 Insufficient system storage"
            Reason = "Freier Speicher zu niedrig (${freeSpaceMB}MB < $($limits.MinFreeDiskSpaceMB)MB)"
            PendingCount = $pendingCount
            FreeSpaceMB = $freeSpaceMB
        }
    }

    return [pscustomobject]@{
        Accept = $true
        SmtpCode = $null
        Reason = "OK"
        PendingCount = $pendingCount
        FreeSpaceMB = $freeSpaceMB
    }
}

function Save-SmtpMessage {
    param(
        [Parameter(Mandatory)]
        [AllowEmptyCollection()]
        [AllowEmptyString()]
        [System.Collections.Generic.List[string]]$Lines,

        [Parameter(Mandatory)]
        [string]$MailFrom,

        [Parameter(Mandatory)]
        [string[]]$Recipients,

        [Parameter(Mandatory)]
        [string]$RemoteAddress,

        [string]$AuthenticatedUser,

        [string]$QueueId
    )

    $dirs = Get-QueueDirectories

    if ([string]::IsNullOrWhiteSpace($QueueId)) {
        $QueueId = New-QueueId
    }

    $incomingEmlTmp = Join-Path $dirs.Incoming "$QueueId.eml.tmp"
    $incomingMetaTmp = Join-Path $dirs.Incoming "$QueueId.eml.json.tmp"

    $pendingEml = Join-Path $dirs.Pending "$QueueId.eml"
    $pendingMeta = "$pendingEml.json"

    $messageLines = Add-RelayMessageHeaders `
        -Lines $Lines `
        -QueueId $QueueId `
        -RemoteAddress $RemoteAddress

    # SMTP DATA wird in CRLF normalisiert.
    $raw = ($messageLines -join "`r`n") + "`r`n"
    $utf8NoBom = New-Object System.Text.UTF8Encoding($false)

    $meta = [ordered]@{
        QueueId = $QueueId
        ReceivedUtc = [DateTime]::UtcNow.ToString("o")
        RemoteAddress = $RemoteAddress
        AuthenticatedUser = $AuthenticatedUser
        EnvelopeFrom = $MailFrom
        EnvelopeRecipients = @($Recipients)
        RetryCount = 0
        NextAttemptUtc = [DateTime]::UtcNow.ToString("o")
    }

    try {
        # Erst vollständig in incoming schreiben.
        [IO.File]::WriteAllText($incomingEmlTmp, $raw, $utf8NoBom)
        $meta | ConvertTo-Json -Depth 5 | Set-Content -LiteralPath $incomingMetaTmp -Encoding UTF8

        # Metadaten zuerst finalisieren, Maildatei zuletzt.
        # Erst wenn die .eml in pending liegt, ist sie für den Worker sichtbar.
        Move-Item -LiteralPath $incomingMetaTmp -Destination $pendingMeta -Force
        Move-Item -LiteralPath $incomingEmlTmp -Destination $pendingEml -Force
    }
    catch {
        Remove-Item -LiteralPath $incomingEmlTmp -Force -ErrorAction SilentlyContinue
        Remove-Item -LiteralPath $incomingMetaTmp -Force -ErrorAction SilentlyContinue
        Remove-Item -LiteralPath $pendingMeta -Force -ErrorAction SilentlyContinue
        Remove-Item -LiteralPath $pendingEml -Force -ErrorAction SilentlyContinue
        throw
    }

    $authText = if ([string]::IsNullOrWhiteSpace($AuthenticatedUser)) { "unauthenticated" } else { $AuthenticatedUser }
    Write-Log "[$QueueId] Mail angenommen | Von=$MailFrom | An=$($Recipients -join ', ') | Client=$RemoteAddress | Auth=$authText"
    return [pscustomobject]@{
        QueueId = $QueueId
        Path = $pendingEml
    }
}

function Write-SmtpLine {
    param(
        [Parameter(Mandatory)][System.IO.StreamWriter]$Writer,
        [Parameter(Mandatory)][string]$Line
    )
    $Writer.WriteLine($Line)
    $Writer.Flush()
}

function Handle-SmtpClient {
    param([Parameter(Mandatory)][System.Net.Sockets.TcpClient]$Client)

    $remote = $Client.Client.RemoteEndPoint
    $remoteIp = ([System.Net.IPEndPoint]$remote).Address
    Write-Log "SMTP-Verbindung von $remoteIp"

    if (-not (Test-ClientAllowed -Address $remoteIp)) {
        try {
            $stream = $Client.GetStream()
            $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII)
            $writer.NewLine = "`r`n"
            $writer.AutoFlush = $true
            Write-SmtpLine $writer "554 5.7.1 Client not allowed"
        } catch {}

        $Client.Close()
        Write-Log "Client abgewiesen: $remoteIp" "WARN"
        return
    }

    $stream = $Client.GetStream()
    $stream.ReadTimeout = [int]$script:Config.Smtp.ClientTimeoutSeconds * 1000

    $reader = New-Object System.IO.StreamReader(
        $stream,
        [System.Text.Encoding]::UTF8,
        $true,
        4096,
        $true
    )

    $writer = New-Object System.IO.StreamWriter(
        $stream,
        [System.Text.Encoding]::ASCII,
        4096,
        $true
    )

    $writer.NewLine = "`r`n"
    $writer.AutoFlush = $true

    $mailFrom = $null
    $recipients = New-Object System.Collections.Generic.List[string]
    $acceptedMessages = 0
    $limits = Get-SmtpLimits
    $authSettings = Get-SmtpAuthSettings

    $authenticated = $false
    $authenticatedUser = $null
    $authFailures = 0
    $authLocked = $false
    $authRequired = Test-SmtpAuthenticationRequired -Address $remoteIp
    $authAvailable = (@($authSettings.Users).Count -gt 0)

    Write-SmtpLine $writer ("220 {0} SMTPGraphRelay ready" -f $script:Config.Smtp.Hostname)

    try {
        while ($Client.Connected) {
            $line = $reader.ReadLine()
            if ($null -eq $line) { break }

            if ($line -match '^(?i)EHLO\s+(.+)$') {
                Write-SmtpLine $writer ("250-{0}" -f $script:Config.Smtp.Hostname)
                Write-SmtpLine $writer ("250-SIZE {0}" -f ([int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024))

                if ($authAvailable) {
                    Write-SmtpLine $writer "250-AUTH LOGIN PLAIN"
                }

                Write-SmtpLine $writer "250 8BITMIME"
            }
            elseif ($line -match '^(?i)HELO\s+(.+)$') {
                Write-SmtpLine $writer ("250 {0}" -f $script:Config.Smtp.Hostname)
            }
            elseif ($line -match '^(?i)AUTH\s+LOGIN(?:\s+(\S+))?\s*$') {
                if (-not $authAvailable) {
                    Write-SmtpLine $writer "504 5.7.4 Authentication mechanism unavailable"
                    continue
                }

                if ($authenticated) {
                    Write-SmtpLine $writer "503 5.5.0 Already authenticated"
                    continue
                }

                if ($authLocked) {
                    Write-SmtpLine $writer "454 4.7.0 Too many authentication failures"
                    continue
                }

                $initial = $matches[1]
                $result = Invoke-SmtpAuthLogin -Reader $reader -Writer $writer -InitialResponse $initial

                if ($result.ProtocolError) {
                    $authFailures++
                    Write-SmtpLine $writer "501 5.5.2 Invalid authentication data"
                }
                elseif ($result.Valid) {
                    $authenticated = $true
                    $authenticatedUser = $result.Username
                    $authFailures = 0
                    Write-SmtpLine $writer "235 2.7.0 Authentication successful"
                    Write-Log ("SMTP-AUTH LOGIN erfolgreich | Client={0} | Benutzer={1}" -f $remoteIp, $authenticatedUser)
                    continue
                }
                else {
                    $authFailures++
                    Write-SmtpLine $writer "535 5.7.8 Authentication credentials invalid"
                    Write-Log ("SMTP-AUTH LOGIN fehlgeschlagen | Client={0} | Benutzer={1}" -f $remoteIp, $result.Username) "WARN"
                }

                if ($authFailures -ge $authSettings.AuthMaxFailures) {
                    $authLocked = $true
                    Write-Log ("SMTP-AUTH gesperrt nach {0} Fehlversuchen | Client={1}" -f $authFailures, $remoteIp) "WARN"
                }
            }
            elseif ($line -match '^(?i)AUTH\s+PLAIN(?:\s+(\S+))?\s*$') {
                if (-not $authAvailable) {
                    Write-SmtpLine $writer "504 5.7.4 Authentication mechanism unavailable"
                    continue
                }

                if ($authenticated) {
                    Write-SmtpLine $writer "503 5.5.0 Already authenticated"
                    continue
                }

                if ($authLocked) {
                    Write-SmtpLine $writer "454 4.7.0 Too many authentication failures"
                    continue
                }

                $initial = $matches[1]
                $result = Invoke-SmtpAuthPlain -Reader $reader -Writer $writer -InitialResponse $initial

                if ($result.ProtocolError) {
                    $authFailures++
                    Write-SmtpLine $writer "501 5.5.2 Invalid authentication data"
                }
                elseif ($result.Valid) {
                    $authenticated = $true
                    $authenticatedUser = $result.Username
                    $authFailures = 0
                    Write-SmtpLine $writer "235 2.7.0 Authentication successful"
                    Write-Log ("SMTP-AUTH PLAIN erfolgreich | Client={0} | Benutzer={1}" -f $remoteIp, $authenticatedUser)
                    continue
                }
                else {
                    $authFailures++
                    Write-SmtpLine $writer "535 5.7.8 Authentication credentials invalid"
                    Write-Log ("SMTP-AUTH PLAIN fehlgeschlagen | Client={0} | Benutzer={1}" -f $remoteIp, $result.Username) "WARN"
                }

                if ($authFailures -ge $authSettings.AuthMaxFailures) {
                    $authLocked = $true
                    Write-Log ("SMTP-AUTH gesperrt nach {0} Fehlversuchen | Client={1}" -f $authFailures, $remoteIp) "WARN"
                }
            }
            elseif ($line -match '^(?i)AUTH\b') {
                Write-SmtpLine $writer "504 5.5.4 Unsupported authentication mechanism"
            }
            elseif ($line -match '^(?i)MAIL FROM:\s*<([^>]*)>') {
                if ($authRequired -and -not $authenticated) {
                    Write-SmtpLine $writer "530 5.7.0 Authentication required"
                    continue
                }

                if ($acceptedMessages -ge $limits.MaxMessagesPerConnection) {
                    Write-SmtpLine $writer "452 4.5.3 Too many messages in this session"
                    Write-Log ("SMTP-Session von {0}: Nachrichtenlimit {1} erreicht." -f $remoteIp, $limits.MaxMessagesPerConnection) "WARN"
                    continue
                }

                $mailFrom = $matches[1]
                $recipients.Clear()
                Write-SmtpLine $writer "250 2.1.0 OK"
            }
            elseif ($line -match '^(?i)RCPT TO:\s*<([^>]+)>') {
                if (-not $mailFrom) {
                    Write-SmtpLine $writer "503 5.5.1 Need MAIL FROM first"
                    continue
                }

                if ($recipients.Count -ge $limits.MaxRecipients) {
                    Write-SmtpLine $writer "452 4.5.3 Too many recipients"
                    Write-Log ("SMTP-Session von {0}: Empfängerlimit {1} erreicht." -f $remoteIp, $limits.MaxRecipients) "WARN"
                    continue
                }

                $recipients.Add($matches[1])
                Write-SmtpLine $writer "250 2.1.5 OK"
            }
            elseif ($line -match '^(?i)DATA\s*$') {
                if ($authRequired -and -not $authenticated) {
                    Write-SmtpLine $writer "530 5.7.0 Authentication required"
                    continue
                }

                if (-not $mailFrom -or $recipients.Count -eq 0) {
                    Write-SmtpLine $writer "503 5.5.1 Need MAIL FROM and RCPT TO first"
                    continue
                }

                if ($acceptedMessages -ge $limits.MaxMessagesPerConnection) {
                    Write-SmtpLine $writer "452 4.5.3 Too many messages in this session"
                    continue
                }

                $pressure = Get-QueuePressure
                if (-not $pressure.Accept) {
                    Write-SmtpLine $writer $pressure.SmtpCode
                    Write-Log ("SMTP-Backpressure für {0}: {1}" -f $remoteIp, $pressure.Reason) "WARN"
                    continue
                }

                Write-SmtpLine $writer "354 End data with <CR><LF>.<CR><LF>"

                $data = New-Object System.Collections.Generic.List[string]
                $size = 0
                $maxBytes = [int64]$script:Config.Smtp.MaxMessageSizeMB * 1024 * 1024
                $tooLarge = $false

                while ($true) {
                    $dataLine = $reader.ReadLine()

                    if ($null -eq $dataLine) {
                        throw "Client disconnected during DATA"
                    }

                    if ($dataLine -eq ".") {
                        break
                    }

                    if ($dataLine.StartsWith("..")) {
                        $dataLine = $dataLine.Substring(1)
                    }

                    $size += [System.Text.Encoding]::UTF8.GetByteCount($dataLine) + 2

                    if ($size -gt $maxBytes) {
                        $tooLarge = $true
                    }
                    elseif (-not $tooLarge) {
                        $data.Add($dataLine)
                    }
                }

                if ($tooLarge) {
                    Write-SmtpLine $writer "552 5.3.4 Message size exceeds fixed maximum message size"
                    Write-Log "Mail von $remoteIp wegen Größenlimit verworfen." "WARN"
                }
                else {
                    $queueId = New-QueueId

                    try {
                        $saved = Save-SmtpMessage `
                            -Lines $data `
                            -MailFrom $mailFrom `
                            -Recipients $recipients.ToArray() `
                            -RemoteAddress $remoteIp.ToString() `
                            -AuthenticatedUser $authenticatedUser `
                            -QueueId $queueId

                        $acceptedMessages++

                        Write-SmtpLine $writer (
                            "250 2.0.0 Message accepted for delivery; queue-id={0}" -f $saved.QueueId
                        )
                    }
                    catch {
                        Write-SmtpLine $writer "451 4.3.0 SMTPGraphRelay queue temporarily unavailable"

                        Write-Log (
                            "[{0}] Queue-Speicherung fehlgeschlagen | Client={1} | Fehler={2}" -f `
                            $queueId,
                            $remoteIp,
                            $_.Exception.Message
                        ) "ERROR"
                    }
                }

                $mailFrom = $null
                $recipients.Clear()
            }
            elseif ($line -match '^(?i)RSET\s*$') {
                $mailFrom = $null
                $recipients.Clear()
                Write-SmtpLine $writer "250 2.0.0 Reset"
            }
            elseif ($line -match '^(?i)NOOP(?:\s+.*)?$') {
                Write-SmtpLine $writer "250 2.0.0 OK"
            }
            elseif ($line -match '^(?i)QUIT\s*$') {
                Write-SmtpLine $writer "221 2.0.0 Bye"
                break
            }
            elseif ($line -match '^(?i)STARTTLS\b') {
                Write-SmtpLine $writer "502 5.5.1 Command not implemented"
            }
            else {
                Write-SmtpLine $writer "500 5.5.2 Command unrecognized"
            }
        }
    }
    catch {
        Write-Log "SMTP-Clientfehler ${remoteIp}: $($_.Exception.Message)" "WARN"
    }
    finally {
        try { $reader.Dispose() } catch {}
        try { $writer.Dispose() } catch {}
        try { $stream.Dispose() } catch {}
        try { $Client.Close() } catch {}
    }
}

function Get-RelayCertificateStatus {
    $thumbprint = [string]$script:Config.Graph.CertificateThumbprint

    if ([string]::IsNullOrWhiteSpace($thumbprint)) {
        throw "Graph.CertificateThumbprint fehlt in config.json."
    }

    $certPath = "Cert:\LocalMachine\My\$thumbprint"
    $cert = Get-Item -LiteralPath $certPath -ErrorAction Stop

    if (-not $cert.HasPrivateKey) {
        throw "Relay-Zertifikat '$thumbprint' besitzt keinen privaten Schlüssel."
    }

    $remaining = $cert.NotAfter.ToUniversalTime() - [DateTime]::UtcNow

    return [pscustomobject]@{
        Certificate = $cert
        Thumbprint = $cert.Thumbprint
        Subject = $cert.Subject
        NotBefore = $cert.NotBefore
        NotAfter = $cert.NotAfter
        DaysRemaining = [Math]::Floor($remaining.TotalDays)
        HoursRemaining = [Math]::Floor($remaining.TotalHours)
        Expired = ($remaining.TotalSeconds -le 0)
    }
}

function Test-RelayCertificateExpiry {
    param(
        [switch]$ForceLog
    )

    try {
        $status = Get-RelayCertificateStatus

        $warningDays = 60
        $criticalDays = 14

        if ($script:Config.Graph.PSObject.Properties.Name -contains "CertificateWarningDays") {
            try { $warningDays = [int]$script:Config.Graph.CertificateWarningDays } catch {}
        }

        if ($script:Config.Graph.PSObject.Properties.Name -contains "CertificateCriticalDays") {
            try { $criticalDays = [int]$script:Config.Graph.CertificateCriticalDays } catch {}
        }

        if ($status.Expired) {
            Write-Log ("KRITISCH: Graph-Zertifikat {0} ist seit {1} abgelaufen!" -f `
                $status.Thumbprint, $status.NotAfter.ToString("yyyy-MM-dd HH:mm:ss")) "ERROR"
            return $status
        }

        if ($status.DaysRemaining -le $criticalDays) {
            Write-Log ("KRITISCH: Graph-Zertifikat läuft in {0} Tagen ab ({1}). Bitte Zertifikat erneuern." -f `
                $status.DaysRemaining, $status.NotAfter.ToString("yyyy-MM-dd HH:mm:ss")) "ERROR"
        }
        elseif ($status.DaysRemaining -le $warningDays) {
            Write-Log ("WARNUNG: Graph-Zertifikat läuft in {0} Tagen ab ({1}). Zertifikatsrotation einplanen." -f `
                $status.DaysRemaining, $status.NotAfter.ToString("yyyy-MM-dd HH:mm:ss")) "WARN"
        }
        elseif ($ForceLog) {
            Write-Log ("Graph-Zertifikat gültig bis {0} ({1} Tage verbleibend)." -f `
                $status.NotAfter.ToString("yyyy-MM-dd HH:mm:ss"), $status.DaysRemaining)
        }

        return $status
    }
    catch {
        Write-Log ("Zertifikatsprüfung fehlgeschlagen: {0}" -f $_.Exception.Message) "ERROR"
        return $null
    }
}

function Get-FunctionBootstrap {
    param(
        [Parameter(Mandatory)]
        [string[]]$FunctionNames
    )

    $parts = New-Object System.Collections.Generic.List[string]

    foreach ($name in $FunctionNames) {
        $item = Get-Item -LiteralPath ("Function:\{0}" -f $name) -ErrorAction Stop
        $parts.Add(("function {0} {{`r`n{1}`r`n}}" -f $name, $item.Definition))
    }

    return ($parts -join "`r`n`r`n")
}

function New-WorkerConfig {
    # Runspaces haben keinen verlässlichen $PSScriptRoot des Hauptskripts.
    # Deshalb werden alle Pfade für Worker einmal absolut aufgelöst.
    $copy = $script:Config | ConvertTo-Json -Depth 20 | ConvertFrom-Json

    $copy.Paths.Queue = Resolve-PathFromConfig $script:Config.Paths.Queue
    $copy.Paths.Failed = Resolve-PathFromConfig $script:Config.Paths.Failed
    $copy.Paths.Logs = Resolve-PathFromConfig $script:Config.Paths.Logs

    return $copy
}

function Send-ServiceBusyAndClose {
    param(
        [Parameter(Mandatory)]
        [System.Net.Sockets.TcpClient]$Client
    )

    try {
        $stream = $Client.GetStream()
        $writer = New-Object System.IO.StreamWriter($stream, [System.Text.Encoding]::ASCII, 1024, $true)
        $writer.NewLine = "`r`n"
        $writer.AutoFlush = $true
        $writer.WriteLine("421 4.3.2 SMTPGraphRelay busy, try again later")
        $writer.Flush()
        $writer.Dispose()
        $stream.Dispose()
    }
    catch {}
    finally {
        try { $Client.Close() } catch {}
    }
}

function Remove-CompletedSmtpWorkers {
    for ($i = $script:ActiveSmtpWorkers.Count - 1; $i -ge 0; $i--) {
        $worker = $script:ActiveSmtpWorkers[$i]

        if ($worker.AsyncResult.IsCompleted) {
            try {
                [void]$worker.PowerShell.EndInvoke($worker.AsyncResult)
            }
            catch {
                Write-Log ("SMTP-Worker für {0} wurde mit Fehler beendet: {1}" -f $worker.RemoteAddress, $_.Exception.Message) "WARN"
            }
            finally {
                try { $worker.PowerShell.Dispose() } catch {}
                $script:ActiveSmtpWorkers.RemoveAt($i)
            }
        }
    }
}

function Start-SmtpClientWorker {
    param(
        [Parameter(Mandatory)]
        [System.Net.Sockets.TcpClient]$Client
    )

    Remove-CompletedSmtpWorkers

    $remoteAddress = "unknown"
    try {
        $remoteAddress = ([System.Net.IPEndPoint]$Client.Client.RemoteEndPoint).Address.ToString()
    } catch {}

    if ($script:ActiveSmtpWorkers.Count -ge $script:MaxConcurrentClients) {
        Write-Log ("SMTP-Verbindung von {0} abgewiesen: Parallel-Limit {1} erreicht." -f $remoteAddress, $script:MaxConcurrentClients) "WARN"
        Send-ServiceBusyAndClose -Client $Client
        return
    }

    $ps = [System.Management.Automation.PowerShell]::Create()
    $ps.RunspacePool = $script:SmtpRunspacePool

    [void]$ps.AddScript($script:SmtpWorkerScript)
    [void]$ps.AddArgument($Client)
    [void]$ps.AddArgument($script:WorkerConfig)

    try {
        $async = $ps.BeginInvoke()

        [void]$script:ActiveSmtpWorkers.Add([pscustomobject]@{
            PowerShell = $ps
            AsyncResult = $async
            Client = $Client
            RemoteAddress = $remoteAddress
            StartedUtc = [DateTime]::UtcNow
        })
    }
    catch {
        try { $ps.Dispose() } catch {}
        try { $Client.Close() } catch {}
        throw
    }
}

if (-not (Test-Path -LiteralPath $ConfigPath)) {
    throw "Konfiguration nicht gefunden: $ConfigPath. Bitte zuerst Setup-SMTPGraphRelay.ps1 ausführen."
}

$script:Config = Get-Content -LiteralPath $ConfigPath -Raw -Encoding UTF8 | ConvertFrom-Json

New-Item -ItemType Directory -Path (Resolve-PathFromConfig $script:Config.Paths.Logs) -Force | Out-Null
Initialize-QueueDirectories

# Alte Logarchive beim Start direkt bereinigen.
Invoke-LogMaintenance -Force

# Zertifikat beim Start immer prüfen und Status protokollieren.
[void](Test-RelayCertificateExpiry -ForceLog)

# Prüfintervall optional per config, Standard 12 Stunden.
$script:CertificateCheckHours = 12
if ($script:Config.Graph.PSObject.Properties.Name -contains "CertificateCheckHours") {
    try {
        $configuredHours = [int]$script:Config.Graph.CertificateCheckHours
        if ($configuredHours -ge 1 -and $configuredHours -le 168) {
            $script:CertificateCheckHours = $configuredHours
        }
    } catch {}
}
$script:NextCertificateCheck = (Get-Date).AddHours($script:CertificateCheckHours)

# MaxConcurrentClients ist optional, damit bestehende config.json-Dateien unverändert weiterlaufen.
$script:MaxConcurrentClients = 20
if ($script:Config.Smtp.PSObject.Properties.Name -contains "MaxConcurrentClients") {
    try {
        $configuredMax = [int]$script:Config.Smtp.MaxConcurrentClients
        if ($configuredMax -ge 1 -and $configuredMax -le 200) {
            $script:MaxConcurrentClients = $configuredMax
        }
        else {
            Write-Log "Ungültiges Smtp.MaxConcurrentClients; verwende Standard 20." "WARN"
        }
    }
    catch {
        Write-Log "Smtp.MaxConcurrentClients konnte nicht gelesen werden; verwende Standard 20." "WARN"
    }
}

$script:WorkerConfig = New-WorkerConfig

# ---------------------------------------------------------------------------
# SMTP Runspace Pool
# ---------------------------------------------------------------------------
# Nur die Funktionen, die ein SMTP-Client wirklich benötigt, werden in die
# Worker-Runspaces kopiert. Graph-/Queue-Versand bleibt in einem separaten Worker.
$smtpFunctionNames = @(
    "Get-LogSettings",
    "Invoke-LogMaintenance",
    "Rotate-LogIfNeeded",
    "Write-Log",
    "Resolve-PathFromConfig",
    "Test-IPv4InCidr",
    "Test-ClientAllowed",
    "Get-QueueDirectories",
    "New-QueueId",
    "Add-RelayMessageHeaders",
    "Test-AddressInList",
    "Get-SmtpAuthSettings",
    "Test-SmtpAuthenticationRequired",
    "ConvertFrom-Base64Utf8",
    "Invoke-Pbkdf2Sha256",
    "Test-FixedTimeEquals",
    "Test-SmtpCredentials",
    "Invoke-SmtpAuthLogin",
    "Invoke-SmtpAuthPlain",
    "Get-SmtpLimits",
    "Get-QueuePressure",
    "Save-SmtpMessage",
    "Write-SmtpLine",
    "Handle-SmtpClient"
)

$smtpBootstrap = Get-FunctionBootstrap -FunctionNames $smtpFunctionNames
$script:SmtpWorkerScript = @"
param(`$Client, `$Config)
`$script:Config = `$Config

$smtpBootstrap

Handle-SmtpClient -Client `$Client
"@

$script:SmtpRunspacePool = [System.Management.Automation.Runspaces.RunspaceFactory]::CreateRunspacePool(
    1,
    $script:MaxConcurrentClients
)
$script:SmtpRunspacePool.Open()
$script:ActiveSmtpWorkers = New-Object System.Collections.ArrayList

# ---------------------------------------------------------------------------
# Separater Queue-/Graph-Worker
# ---------------------------------------------------------------------------
# Damit ein langsamer Graph-Aufruf nicht mehr die Annahme neuer SMTP-Verbindungen
# blockiert, läuft Process-Queue dauerhaft in einem eigenen Runspace.
$queueFunctionNames = @(
    "Get-LogSettings",
    "Invoke-LogMaintenance",
    "Rotate-LogIfNeeded",
    "Write-Log",
    "Resolve-PathFromConfig",
    "Get-GraphConnection",
    "Set-MimeSender",
    "Get-QueueDirectories",
    "Get-GraphFailureInfo",
    "Get-RetryDecision",
    "Move-QueueItem",
    "Send-QueuedMail",
    "Process-Queue"
)

$queueBootstrap = Get-FunctionBootstrap -FunctionNames $queueFunctionNames
$queueWorkerScript = @"
param(`$Config)
`$script:Config = `$Config

$queueBootstrap

try {
    while (`$true) {
        try {
            Process-Queue
        }
        catch {
            Write-Log ("Queue-Worker: {0}" -f `$_.Exception.Message) "ERROR"
        }

        Start-Sleep -Seconds ([int]`$script:Config.Queue.PollSeconds)
    }
}
finally {
    try { Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null } catch {}
}
"@

$script:QueuePowerShell = [System.Management.Automation.PowerShell]::Create()
[void]$script:QueuePowerShell.AddScript($queueWorkerScript)
[void]$script:QueuePowerShell.AddArgument($script:WorkerConfig)
$script:QueueAsyncResult = $script:QueuePowerShell.BeginInvoke()

# ---------------------------------------------------------------------------
# Listener
# ---------------------------------------------------------------------------
$listenIp = [System.Net.IPAddress]::Parse($script:Config.Smtp.ListenAddress)
$listener = [System.Net.Sockets.TcpListener]::new($listenIp, [int]$script:Config.Smtp.Port)
$listener.Start()

Write-Log "SMTPGraphRelay V1.7 gestartet auf $($script:Config.Smtp.ListenAddress):$($script:Config.Smtp.Port)"
Write-Log "Graph-Absender: $($script:Config.Graph.SenderMailbox)"
Write-Log "Maximale parallele SMTP-Verbindungen: $script:MaxConcurrentClients"
Write-Log "Queue-/Graph-Worker läuft separat vom SMTP-Listener."

$limits = Get-SmtpLimits
Write-Log ("SMTP-Limits: max. {0} Empfänger/Mail, {1} Mails/Verbindung." -f `
    $limits.MaxRecipients, $limits.MaxMessagesPerConnection)
Write-Log ("Backpressure: max. {0} Pending-Mails, mindestens {1} MB freier Speicher." -f `
    $limits.MaxPendingMessages, $limits.MinFreeDiskSpaceMB)

$authSettings = Get-SmtpAuthSettings
$authMode = if ($authSettings.RequireAuth) { "erforderlich" } else { "optional/deaktiviert" }
Write-Log ("SMTP-AUTH: {0}; {1} Benutzer; max. {2} Fehlversuche/Verbindung." -f `
    $authMode, @($authSettings.Users).Count, $authSettings.AuthMaxFailures)

$logSettings = Get-LogSettings
Write-Log ("Log-Rotation: max. {0} MB pro Datei, Aufbewahrung {1} Tage." -f `
    $logSettings.MaxFileSizeMB, $logSettings.RetentionDays)

try {
    while ($true) {
        Remove-CompletedSmtpWorkers

        if ((Get-Date) -ge $script:NextCertificateCheck) {
            [void](Test-RelayCertificateExpiry)
            $script:NextCertificateCheck = (Get-Date).AddHours($script:CertificateCheckHours)
        }

        # Sollte der Queue-Worker unerwartet beendet werden, Relay nicht still
        # ohne Versand weiterlaufen lassen.
        if ($script:QueueAsyncResult.IsCompleted) {
            try {
                [void]$script:QueuePowerShell.EndInvoke($script:QueueAsyncResult)
                throw "Queue-Worker wurde unerwartet beendet."
            }
            catch {
                throw "Queue-Worker wurde unerwartet beendet: $($_.Exception.Message)"
            }
        }

        if ($listener.Pending()) {
            $client = $listener.AcceptTcpClient()
            Start-SmtpClientWorker -Client $client
        }
        else {
            Start-Sleep -Milliseconds 100
        }
    }
}
finally {
    Write-Log "SMTPGraphRelay wird beendet..." "INFO"

    try { $listener.Stop() } catch {}

    # Neue Clients werden nicht mehr angenommen; bestehende Sessions schließen.
    foreach ($worker in @($script:ActiveSmtpWorkers)) {
        try { $worker.Client.Close() } catch {}
        try { $worker.PowerShell.Stop() } catch {}
        try {
            if ($worker.AsyncResult) {
                [void]$worker.PowerShell.EndInvoke($worker.AsyncResult)
            }
        } catch {}
        try { $worker.PowerShell.Dispose() } catch {}
    }
    $script:ActiveSmtpWorkers.Clear()

    try { $script:SmtpRunspacePool.Close() } catch {}
    try { $script:SmtpRunspacePool.Dispose() } catch {}

    try { $script:QueuePowerShell.Stop() } catch {}
    try {
        if ($script:QueueAsyncResult) {
            [void]$script:QueuePowerShell.EndInvoke($script:QueueAsyncResult)
        }
    } catch {}
    try { $script:QueuePowerShell.Dispose() } catch {}

    try { Disconnect-MgGraph -ErrorAction SilentlyContinue | Out-Null } catch {}
    Write-Log "SMTPGraphRelay beendet."
}